452
Configuring Port-Based Traffic Control
Information About Port-Based Traffic Control
When a trunk port configured with port security and assigned to an access VLAN for data traffic and to a voice VLAN
for voice traffic, entering the switchport voice and switchport priority extend interface configuration commands
has no effect.
When a connected device uses the same MAC address to request an IP address for the access VLAN and then an
IP address for the voice VLAN, only the access VLAN is assigned an IP address.
When confguring port security, first specify the total number of MAC addresses you want to allow, by using the
switchport port-security maximum interface configuration command and then configure the number of access
VLANs (switchport port-security vlan access interface configuration command) and voice VLANs (switchport
port-security vlan voice interface configuration command) you want to allow. If you do not specify the total number
first, the system returns to the default setting (1 MAC address).
When you enter a maximum secure address value for an interface, and the new value is greater than the previous
value, the new value overwrites the previously configured value. If the new value is less than the previous value and
the number of configured secure addresses on the interface exceeds the new value, the command is rejected.
The switch does not support port security aging of sticky secure MAC addresses.
Port Security Aging
You can use port security aging to set the aging time for all secure addresses on a port. Two types of aging are supported
per port:
Absolute—The secure addresses on the port are deleted after the specified aging time.
Type of Port or Feature on Port Compatible with Port Security
DTP
1
port
2
1. DTP = Dynamic Trunking Protocol
2. A port configured with the switchport mode dynamic interface configuration command.
No
Trunk port Yes
Dynamic-access port
3
3. A VLAN Query Protocol (VQP) port configured with the switchport access vlan dynamic interface configuration
command.
No
Routed port No
SPAN source port Yes
SPAN destination port No
EtherChannel No
Tunneling port Yes
Protected port Yes
IEEE 802.1x port Yes
Voice VLAN port
4
4. You must set the maximum allowed secure addresses on the port to two plus the maximum number of secure
addresses allowed on the access VLAN.
Yes
Private VLAN port Yes
IP source guard Yes
Dynamic Address Resolution Protocol (ARP) inspection Yes
FlexLinks Yes
To Next Page
Loading...
Need help?
General
